Zero Escrow Risk • Direct Paytm Settlement

Accept UPI with
Zero Middleman Fees.

Stop paying 2% on every swipe. Route instant UPI payments directly into your verified Paytm Business account with dynamic QR intents and signed HMAC webhooks.

Get Free API Key View API Reference
dynamic-upi-checkout
Active Rail
Scan & Pay via UPI
₹2,399.00
ORDER_67A419B8E3D Ready for Scan
GPay PhonePe Paytm BHIM
Why Developers Choose UPay

Direct Rail. Zero Intermediary.

0% Gateway Commission

Unlike traditional gateways taking 2-3% of every transaction, all money goes 100% straight to you.

Non-Custodial Settlement

Funds are never pooled or held in escrow. Payer settlements deposit straight into your linked Paytm Business VPA.

Real-Time Signed Webhooks

Receive instant HTTPS POST webhooks protected by SHA256 HMAC digital signatures to safely auto-fulfill orders.

Direct Settlement Pipeline

How the Rail Operates

Your Server Calls API UPay Engine Generates QR Direct Intent Paytm VPA Direct Settle ⚡ Signed Webhook
REST Integration Guide

Create Order Endpoint

Initiate a payment order by providing your secret key (`api`) and merchant identifier (`MID`).

POST https://www.u-pay-seven.vercel.app/api/create-order
Content-Type: application/json

Creates a payment session and returns a dynamic payment link (`/pay/:orderId`) containing QR codes and app intent triggers.

Field Type Status Description
api String Required Your secret API Key generated from dashboard
MID String Required Your Paytm Merchant Identifier
amount Number/String Required Order amount in INR (e.g. 2399 or "2399.00")
customerEmail String Required Customer email for notification and confirmation
customerName String Optional Payer name for your transaction records
customerMobile String Optional 10-digit mobile phone number 
curl -X POST https://www.u-pay-seven.vercel.app/api/create-order \
  -H "Content-Type: application/json" \
  -d '{
    "api": "YOUR_SECRET_KEY",
    "MID": "YOUR_MID",
    "amount": 2399,
    "customerEmail": "customer@example.com",
    "customerName": "Rahul Sharma",
    "customerMobile": "9876543210"
  }'

Expected Response (200 OK)

{
  "status": true,
  "order": "ORDER_67A419B8E3D",
  "message": "Order Created",
  "link": "https://www.u-pay-seven.vercel.app/pay/ORDER_67A419B8E3D",
  "timestamp": 1740000000000
}
Tamper-Proof Verification

Webhook Security & HMAC

When a payment completes, UPay issues an HTTP POST callback to your Success Callback URL. Verify the signature by computing HMAC-SHA256 across the exact stringified payload object.

Incoming Webhook Payload

POST (Callback URL)
{
  "ORDERID": "ORDER_67A419B8E3D",
  "amount": 2399,
  "UTR": "738273824123",
  "status": "SUCCESS",
  "signature": "3fd5b3539bc7aef66f4db9b977bc..."
}
Hashing Specification: The signature is calculated by taking JSON.stringify({ ORDERID, amount, UTR, status }) and hashing it using HMAC-SHA256 with your merchant Secret Key (api).

Express Backend Handler

Node.js + crypto
const express = require('express');
const crypto = require('crypto');
const app = express();

app.use(express.json());

app.post('/api/webhook', (req, res) => {
  const { ORDERID, amount, UTR, status, signature } = req.body;
  const secretKey = process.env.UPAY_SECRET_KEY;

  // 1. Stringify payload matching gateway
  const payment_info = JSON.stringify({
    ORDERID,
    amount,
    UTR,
    status
  });

  // 2. Compute expected HMAC
  const expectedSignature = crypto
    .createHmac("sha256", secretKey)
    .update(payment_info)
    .digest("hex");

  // 3. Constant-time comparison
  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );

  if (!isValid) {
    return res.status(400).send("Tampering detected");
  }

  // 4. Fulfill order
  fulfillOrderInDatabase(ORDERID, UTR);
  res.status(200).json({ received: true });
});

Start Accepting Payments Today

Plug UPay into your cart, connect your Paytm Business VPA, and collect UPI payments with 0% gateway commission.

Launch Merchant Dashboard →